Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated…

Description

Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory.

Scores

EPSS (exploitation in 30 days)

19.0% · top 2.7% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.0.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (10)

• sit-multiple-file-upload(71651) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 50632 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• VU#576355 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• http://secunia.com/secunia_research/2011-79/ (opens in a new tab)x_refsource_MISCx_transferred
• 50896 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 18108 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
• 45453 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://packetstormsecurity.org/files/106933/sit_file_upload.rb.txt (opens in a new tab)x_refsource_MISCx_transferred
• 77003 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• sit-ftpuploadfile-file-upload(71237) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 6 Aug 2024, 23:46 UTC.